Merge remote-tracking branch 'origin/master' into codex/truncated-design

# Conflicts:
#	docs/config-catalog.md
#	docs/rfc/INDEX.md
#	examples/acp-agent/README.md
#	packages/bash/tool-bash/tests/tools.spec.ts

packages/bash/README.md

@@ -9,4 +9,4 @@ The canonical three-package capability seam (see [capability seams](../../docs/r
 | `bash-sandbox/` | Sandbox-consuming `BashExecutor` (wraps every command argv via `ctx.sandbox`, stamps denial/enforcement facts; extends `bash-local`'s mechanics) | (registers `ctx.bash`) |
 | `tool-bash/` | Model-facing `bash`/`bash_output`/`bash_kill` tool schemas | (registers on `ctx.tools`) |
 
-The interface lives at `bash/bash/`. `bash-sandbox` replacing `bash-local` without touching the interface or the tool is the split doing exactly what it exists for — a leaf `cordis.yml` picks one executor entry, plus a `ctx.sandbox` provider entry for the confined one (see [examples/sandbox-acp-agent](../../examples/sandbox-acp-agent/)).
+The interface lives at `bash/bash/`. `bash-sandbox` replacing `bash-local` without touching the interface or the tool is the split doing exactly what it exists for — a leaf `cordis.yml` picks one executor entry, plus a `ctx.sandbox` provider entry for the confined one (see [the acp-agent example's default composition](../../examples/acp-agent/)).

packages/bash/bash-sandbox/README.md

@@ -30,4 +30,4 @@ Deny-only at the seam: a denial is a reported fact, and this executor never nego
     workspaceRoot: !!js process.cwd()
 ```
 
-The keyless consumer-integration proofs are `tests/bwrap.e2e.ts`, `tests/landlock.e2e.ts`, and `tests/seatbelt.e2e.ts` (the real provider + real runner driven through `ctx.bash`, world-verified, each self-skipping where its runner is absent); see [`examples/sandbox-acp-agent`](../../../examples/sandbox-acp-agent/) for the runnable demo.
+The keyless consumer-integration proofs are `tests/bwrap.e2e.ts`, `tests/landlock.e2e.ts`, and `tests/seatbelt.e2e.ts` (the real provider + real runner driven through `ctx.bash`, world-verified, each self-skipping where its runner is absent); see [the acp-agent example's default composition](../../../examples/acp-agent/) for the runnable demo.

packages/bash/tool-bash/tests/tools.spec.ts

@@ -102,16 +102,7 @@ async function callUntilText(
   throw new Error(`${name} output did not include ${JSON.stringify(expected)}; last text was ${JSON.stringify(last !== undefined ? text(last) : '')}`)
 }
 
-class LossyReadBashExecutor extends BashExecutor {
-  private readonly task: BashTask = {
-    id: BashTaskId('bash-lossy'),
-    command: 'fake',
-    status: 'running',
-    exitCode: null,
-    signal: null,
-    done: Promise.resolve(),
-  }
-
+abstract class TestBashExecutor extends BashExecutor {
   resolve(request: BashExecRequest): BashExecSpec {
     return {
       command: request.command,
@@ -123,6 +114,17 @@ class LossyReadBashExecutor extends BashExecutor {
       sandboxMode: request.sandboxMode,
     }
   }
+}
+
+class LossyReadBashExecutor extends TestBashExecutor {
+  private readonly task: BashTask = {
+    id: BashTaskId('bash-lossy'),
+    command: 'fake',
+    status: 'running',
+    exitCode: null,
+    signal: null,
+    done: Promise.resolve(),
+  }
 
   run(): Promise<BashRunResult> {
     return Promise.reject(new Error('not used'))
@@ -1064,7 +1066,7 @@ describe('sandbox rendering', () => {
     // it anyway: an executor that reports no sandboxMode (fields never
     // advertised) whose task nonetheless carries denial facts must render
     // the marker without suggesting a lever the schema does not offer.
-    class FactsOnlyExecutor extends BashExecutor {
+    class FactsOnlyExecutor extends TestBashExecutor {
       private readonly task: BashTask = {
         id: BashTaskId('bash-facts'),
         command: 'fake',
@@ -1075,18 +1077,6 @@ describe('sandbox rendering', () => {
         sandbox: { mode: 'read-only', denied: true },
       }
 
-      resolve(request: BashExecRequest): BashExecSpec {
-        return {
-          command: request.command,
-          workdir: request.workdir ?? process.cwd(),
-          timeoutMs: request.timeoutMs ?? 0,
-          stdoutMaxBytes: request.stdoutMaxBytes ?? 64_000,
-          ...request.signal ? { signal: request.signal } : {},
-          owner: request.owner,
-          sandboxMode: request.sandboxMode,
-        }
-      }
-
       run(): Promise<BashRunResult> { return Promise.reject(new Error('not used')) }
       start(): BashTask { return this.task }
       get(id: string): BashTask | undefined { return id === this.task.id ? this.task : undefined }